maple3142

I get using docker is more painless, but I still prefer running things outside of a container when the setup isn't too complex. It is mostly because I have some heavily customized dev environment including zsh and all other tools installed, so developing in docker always make me miss a lot of things.

I think Python does allow you to play with closure itself by accessing __closure__. Although it is immutable by default, it is still easy to construct another function from code object and closure directly.

But single-file script is still more convenient than two files. e.g. It is easier to scp or copy just one file than two files. Sometimes even if people already know they want to solve X problem, it might still make sense to solve Y problem because the solution to Y problem have some benefit in some cases.

I think the main problem is C modules. CPython only maintains ABI compatibility across minor releases (e.g. 3.10.0 and 3.10.8), so you may need a different binary compiled for CPython 3.9 and 3.10. https://docs.python.org/3/c-api/stable.html

Node.js had `http` in its standard library for a long time though.

Even escapeshellarg might not be enough, because the command you are executing might trying to parse it as options. Depends on which command you are using, it could be exploitable. For example, there is a CTF challenge where you need to get RCE by passing a argument to wget escaped by escapeshellarg. (https://github.com/CykuTW/My-CTF-Challenges/blob/master/TSJ-...)

I always wonder how do people develop in Docker entirely deal with their own shell configuration? Actually install all the tools needed by your .zshrc (or .bashrc) in the container or there is a better solution?

Sometimes, I find it is easier to make your base case broader and bruteforce it one by one when you couldn't get it right. For example, when I tried to exploit RSA parity oracle I couldn't find the right answer when it is narrowed to the smallest range for some unknown reason. Changing the loop condition to `while right-left>1000` works pretty well if you don't want to debug it more.

I wonder how hard is it to escape a unprivileged container as a non-root user in a container. It seems that many CTF organizers already host their RCE challenge this way.

I don't think this will work in JavaScript because that while loop will block the event loop and prevents callback from executing. For example, the following code will be blocked when running in Node.js:

    function delayedValue(val, ms) {
        return new Promise(resolve => setTimeout(() => resolve(val), ms))
    }
    
    function syncFn() {
        let result
        let state = 'pending'
    
        delayedValue(1234, 500)
            .then(data => {
                result = data
                state = 'fulfilled'
            })
            .catch(error => {
                result = error
                state = 'rejected'
            })
        while (state == 'pending') {}
        return result
    }
    console.log('before')
    console.log(syncFn())
    console.log('after')

Iuse AdGuard as a system-wide adblocker on Android, it works pretty well IMO.

JavaScript supports monkey patching by modifying prototype objects too. But it is considered to be bad practice because it modify the behavior globally, and some method name conflict may cause trouble. An example is Array.prototype.contains couldn't be added because it will break another library, so it is renamed to Array.prototype.includes. (Source: https://github.com/tc39/proposal-Array.prototype.includes)

You can have some basic configurable stuffs in an opinionated tool though, see Prettier. It allows tab/space, quote style, line length etc., to be modified.

It might be confusing as it is different from some other languages, such as C++ and JavaScript. They both evaluate default parameter when the function are called.

I wonder if it is true that everything is O(1) if there is an upper bound? Even for an algorithm with O(n^n) complexity, it is still O(1) if n is bounded, just with a extremely large constant.

I think lodash fits this role?

I am not sure if Debian can really keep give packages security updates without feature updates. For example, Debian packaged Chromium seems really outdated and having many unpatched CVEs: https://security-tracker.debian.org/tracker/source-package/c...

I think this is worse because once you have a python 3 only syntax in your script (such as f-string), python 2 will simply throw syntax error because it need to parse the file to execute. The original solution looks hacky, but it can actually inform user to use python 3.

Because DOMPurify is not perfect. Due to some problem of HTML parsing, there were some ways to bypass it: https://research.securitum.com/mutation-xss-via-mathml-mutat...

Having a builtin XSS sanatizer means it could always use a single parser to prevent such bypass.

> Here's a sequence of outputs: 6,5,3,3,3,5. Does this information allow you to predict the next output? No.

Your prng looks like a truncated LCG, it could be broken if enough outputs are known. For example, 16 bits could be bruteforced in this case. If the internal state have more bits, depends on how much bits do the outputs provide, you could probably break it by Lattice (https://crypto.stackexchange.com/questions/37836/problem-wit...).

If you use vscode, maybe you could try this one: https://marketplace.visualstudio.com/items?itemName=pnp.pola...

I am not sure if parsing XML is better than parsing JSON. Many languages or libraries' XML parser are dangerous by default. You usually need to manually configure your XML parser to be secure from XML-related attacks. Fortunately, some languages and libraries are going to make XML have a securer defaults, this is a good change. IMO, I think XML shouldn't have include many questionable features from security perspective.

I think the main difference between OS kernel and browser is the former can decide what they need to support, but the latter need to be compatible in order to render existing website. IMO, Building a new browser is more similar to building a Windows-compatible operating system.

If you don't need to run `docker` command under Windows, install docker directly from distro repo is enough. No need to run another background service. Another benefit is it is faster to build docker images when the files are large, because it doesn't need to move files between WSL VMs.

I think you ultimately need to do something like Function(code)() in JSFuck, so it is always possible to remove the final function call and get the `code` directly.

I think node.js still have a bigger standard library compared to Rust. You can write a http server (including https and http/2) easily with only standard library.

Totally agrees. FireFox devtools UI language is your browser language, and the error messages are also translated. A really annoying thing is there doesn't seem to have an easy way to only switch devtool language to English.

On the other way, Chromium devtools doesn't even have translations so it doesn't have this problem. And the new Edge (Chromium) translates the devtool by default, but there is an option allowing you to switch back to English in devtool only.

> sandbox for everything

IMO, This is the best thing about browser as an OS. You can run untrusted apps and know that it couldn't steal your ssh keys or other things without your consent, similar to iOS and Android.

I think it could because there are much more packaging format other than rpm/deb. What about Arch Linux, Gentoo or even BSDs? It is easier to maintain packages in the same way across platform.

Because many system package managers doesn't support multiple version of a same package easily. Also, there are system (used to) without a package manager.

> causes python devs to often be way too specific in version specs

I don't think anything could fix that, because it is totally up to library developers to decide whether they want to make breaking change or not. So being able to use different exact version of dependencies for different projects are important.

BTW, I find it annoying that many distro package manager doesn't make it easy for user to install package for themselves without root. Even Nix requires you to create /nix IIRC.